app-aerodromes[.]xyz

Analysis of the domain app-aerodromes.xyz, created on 12 March 2026 and currently taken offline, shows multiple indicators of malicious activity. The site resolved to IP address 104.21.52.5, which belongs to AS13335 Cloudflare, Inc., and used Cloudflare's DNS service (jimmy.ns.cloudflare.com, novalee.ns.cloudflare.com). No TLS certificate was observed, meaning the site operated without HTTPS encryption. The page title returned by the server was “Aerodrome Rewards,” a name that does not correspond to a known legitimate brand and suggests a reward‑based lure.

VirusTotal records indicate that three of ninety‑four scanning engines flagged the domain, and the domain is listed on four independent blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. The registrar information points to PDR Ltd. d/b/a PublicDomainRegistry.com, a provider frequently used by short‑lived malicious sites. The presence of Cloudflare and HTTP/3 indicates the operator leveraged a modern CDN to hide origin infrastructure. Although the site is no longer reachable, the combination of a recent registration date, lack of TLS, flagged detections, and inclusion on multiple phishing‑related blocklists classifies the domain as a high‑confidence phishing indicator.

Defenders should continue to block the IP 104.21.52.5 and the domain name at network perimeter devices, DNS resolvers, and endpoint protection solutions. Monitoring of the domain’s registrar and nameserver records is advised in case the site is re‑activated, and any future resolution to the same IP or Cloudflare nameservers should be treated as suspicious. Incident response teams should also correlate any user reports of “Aerodrome Rewards” emails with this indicator to identify potential credential‑ harvesting attempts. The current evidence does not reveal the exact payload or credential‑collection mechanism, so further sandbox analysis of any downloaded artifacts linked from the domain would be required if the site returns online.